JP4615308B2 - Cryptographic apparatus and method, and cryptographic system - Google Patents

Description

  The present invention relates to an encryption apparatus and method, and an encryption system, and more particularly to an apparatus and method for performing encryption / decryption of information in order to reduce the risk of eavesdropping or falsification of information due to an external attack on a network, It is suitable for use in a system to which this is applied.

  When a personal computer (personal computer) is used as a stand-alone, there is little risk that information inside the personal computer will be stolen, altered, or destroyed. However, when a personal computer is connected to a network such as the Internet, the exchanged information is routed through many networks, so that the risk of eavesdropping and tampering in the middle increases at a stretch.

  One mechanism for solving this problem is information encryption. That is, the information is encrypted by the sending personal computer and sent to the other party, and the information is decrypted and used by the receiving personal computer. In this way, even if information is eavesdropped in the middle of the network, since the information is encrypted, the possibility that the information itself can be seen is reduced. In addition, the risk of tampering is reduced.

  However, in order to use encryption, it is necessary to install dedicated encryption software on all terminals to be encrypted and make various settings. However, a network to which various terminals are connected includes a LAN (Local Area Network) in a company in addition to the Internet. In the LAN, terminals such as printers and facsimiles where encryption software cannot be physically installed, terminals such as print servers and database servers where it is not preferable to install extra software due to operational stability problems, OS (operating system) There is also a terminal that functions as a simple network terminal. For this reason, it is generally difficult to use encryption in a corporate LAN.

  However, most LANs are connected to the Internet, and information can be exchanged by accessing the Internet from a personal computer in the LAN as needed. However, when the LAN is connected to the Internet in this way, there is a risk that confidential information inside the LAN will be stolen or tampered with by unauthorized intrusion or attack from the outside.

  Therefore, a firewall is used to prevent a third party who does not have access right from entering the LAN illegally. A firewall generally functions by using a single server as a connection between a LAN and the Internet and operating dedicated software. However, even if a firewall is installed, unauthorized intrusion is often performed by attacking a security hole on the network. Once an illegal intrusion has been made, there is a problem that since the internal information is not encrypted, eavesdropping and tampering can be easily performed.

  Conventionally, a router that is a relay device for routing data flowing on the Internet has an encryption function. For example, a VPN (Virtual Private Network) router. If this VPN router is used, it becomes possible to perform encrypted communication between VPN routers without installing dedicated encryption software on the terminals.

  However, this VPN router is used as a relay on a virtual private line provided for connecting a plurality of LANs using the Internet. Therefore, there is a problem that information exchanged between LANs can be encrypted on the Internet on the way, but information cannot be encrypted in the LAN.

  Further, in order to perform encryption in the VPN router, it is necessary for the router to always have an IP address for communication. This will be described below with reference to FIG. FIG. 1 is a diagram showing a hierarchical structure of protocols in a conventional VPN router and a personal computer connected thereto.

  As shown in FIG. 1, the two personal computers 101 and 102 to be communicated each have one port 105 and 106, and the VPN routers 103 and 104 serving as relays thereof have two ports (107 and 108), respectively. , (109, 110). The physical layer, MAC layer (data link layer), and IP-Sec of the OSI reference model are individually provided for the ports 107 and 108 of the VPN router 103, and the IP layer (network) is common to the ports 107 and 108. Layer) and a TCP / UDP layer (transport layer). The same applies to the ports 109 and 110 of the VPN router 104.

  The deeper the layer, the farther away from the user, and vice versa. A TCP / UDP layer and an application layer (both not shown) exist above the IP layer of each of the personal computers 101 and 102, and a bridge between the application used by the user and the lower layer is performed.

  On the data transmission side, data is converted every time it passes through each layer from the upper layer to the lower layer, and a header for enabling data transmission between the layers is added. Conversely, on the data receiving side, necessary data is extracted in each layer with reference to the header addressed to each layer. Then, the extracted data is delivered to the upper layer and finally delivered to the user via the application layer.

  The function of each layer will be described below. The TCP / UDP layer is a layer that performs identification of an application to which data is to be passed, management of a packet state, and the like. The data transmission side recognizes to which application the data passed from the upper layer (application layer) should be passed, adds the destination port number to the data, and passes it to the lower layer (network layer). On the other hand, the data receiving side monitors whether or not a packet passed from the lower layer is missing due to the communication state or the like.

  The IP layer is a layer for performing arrangements and control related to data transfer or data relay between terminals over a plurality of networks. Different IP addresses (1) and (6) are assigned to the personal computers 101 and 102 on the transmission side and the reception side, which are communication partners, and by clarifying them, a logical communication path by end to end Will be determined. In the case of the VPN routers 103 and 104 having two ports (107, 108) and (109, 110), the IP address is allocated separately for each port.

  The MAC (Media Access Control) layer is a layer for assuring reliable data transmission between nodes of adjacent devices, and has a physical MAC address assigned to each device in the manufacturing stage. On the data transmission side, when the IP address of the communication partner is clarified in the IP layer, the next device (physically connected) is routed based on the established partner's IP address in the MAC layer located below it. Destination of the adjacent node) is determined. On the other hand, on the data receiving side, after recognizing that the packet is addressed to itself based on the MAC address, the IP address of the higher layer is analyzed, and the packet is further routed to other devices. Determine whether you want to do it or incorporate it into yourself.

  The physical layer converts the data passed from the upper layer into an electric signal or an optical signal, and performs actual data transmission via the transmission medium 111 such as a coaxial cable or an optical fiber cable, or is sent from the transmission medium 111. It is a layer for converting electrical signals and optical signals into data that can be recognized by the upper layer and passing it to the upper layer. In the MAC layer, which is an upper layer of the physical layer, the above processing is performed according to a method depending on the communication interface of the physical layer.

  IP-Sec is a functional unit that performs data encryption processing and decryption processing. That is, the data passed from the MAC layer to the IP layer is acquired, and the data is encrypted and decrypted.

  When cryptographic communication is performed between the personal computers 101 and 102 using the VPN routers 103 and 104 having such a hierarchical structure, the VPN router 103 transmits, for example, an IP packet sent from one personal computer 101 to the other personal computer 102. Are received by the first port 107, and the packets are sequentially delivered to the IP layer for decomposition. At this time, the data extracted from the packet is encrypted with IP-Sec. Then, based on the destination IP address included in the packet header, the next forwarding node is determined by referring to the routing table of the router itself, the packet is assembled again from the IP layer to the physical layer, and the second Is sent from the port 108.

  The encrypted packet output from the second port 108 of the VPN router 103 is received by the first port 109 of the VPN router 104. The VPN router 104 sequentially transfers the received encrypted packets to the IP layer and decomposes them, and decrypts the data extracted from the packets by IP-Sec. Then, based on the destination IP address included in the packet header, the next forwarding node is determined by referring to the routing table of the router itself, the packet is assembled again from the IP layer to the physical layer, and the second Is sent from the port 110.

  The IP packet output from the second port 110 is received by the personal computer 102. The received IP packet is sequentially transferred to an upper layer through the physical layer, the MAC layer, and the IP layer and decomposed, and finally data is delivered to the user through an application layer (not shown). According to the above procedure, it is possible to perform encrypted communication between the VPN routers 103 and 104 even if the personal computers 101 and 102 do not include encryption software.

  In the case of the system shown in FIG. 1, different networks (a network A having a personal computer 101 and a network B having a personal computer 102) exist on both sides of the VPN routers 103 and 104, and these constitute a network. Therefore, a different network address is assigned to each network. Therefore, it is essential that the VPN routers 103 and 104 that route (route selection, packet discard, packet division or integration, etc.) between these different networks also have different IP addresses. There was a problem that configuration work had to be done.

  Further, in the VPN routers 103 and 104, the network connected to the first ports 107 and 109 and the network connected to the second ports 108 and 110 are generally different, and therefore different IP addresses are used for each port. Need to be set. Therefore, the IP address changes depending on the input and output of the VPN routers 103 and 104. Therefore, when a VPN router is inserted between terminals on the network or when a VPN router is removed from between terminals, not only the address of the VPN router itself is set, but also the terminal connected to the VPN router. There is also a problem that various complicated operations must be performed.

  For example, when communication is performed without connecting the VPN routers 103 and 104 in the example of FIG. 1, the personal computers 101 and 102 exist in the same network. Direct communication between 102 is possible. In this case, the IP address of the packet transmitted from the personal computer 101 to the personal computer 102 is as shown in FIG. That is, the same network address A may be set for the transmission source IP address (1) of the personal computer 101 on the transmission side and the network address of the destination IP address (6) of the personal computer 102 on the reception side.

  On the other hand, when the VPN routers 103 and 104 are inserted between the personal computer 101 and the personal computer 102, the IP address of the transmitted packet is as shown in FIG. That is, since the personal computers 101 and 102 exist in different networks, different network addresses A and B must be set for the source IP address (1) and the destination IP address (6).

  As described above, when the VPN routers 103 and 104 are inserted between the personal computer 101 and the personal computer 102 or vice versa, the network to which the personal computers 101 and 102 belong is changed. Accordingly, the address of the default gateway of the personal computers 101 and 102 (destination IP address when communicating with a network different from itself (ports 107 and 110 of the VPN routers 103 and 104)) and the personal computers 101 and 102 are set accordingly. It is necessary to change the setting of any of the IP addresses.

  As described above, in the conventional VPN router, it is difficult to maintain transparency depending on the presence or absence of the connection, and there is a problem that a great deal of work must be done at the time of system introduction and maintenance.

  The present invention has been made in order to solve such problems. Even in an in-company LAN having a terminal on which dedicated encryption software cannot be installed, the LAN is used by unauthorized intrusion or attack from the outside using encryption. The purpose is to reduce the risk of the confidential information inside being stolen or altered. Another object of the present invention is to make it possible to use encryption in a corporate LAN without performing complicated work such as address setting.

In the cryptographic apparatus of the present invention, terminals having cryptographic processing functions (including terminals installed with cryptographic software and other cryptographic apparatuses having the functions of the present invention) are connected directly or indirectly to at least one port. Encryption / decryption means for performing data encryption processing and decryption processing for terminating security by encryption between a plurality of ports and a terminal having the encryption processing function, and one of the plurality of ports is input from the port data encryption process or decryption process is performed by the encryption / decryption means, and a bridging means for output to the other ports without the routing process at the network layer, the bridge means Exists below the network layer .

  In another aspect of the present invention, the encryption / decryption means communicates encrypted data with a terminal having the cryptographic processing function and encrypts with a terminal having no cryptographic processing function. The encryption process and the decryption process are performed in order to perform communication of unprocessed data.

In another aspect of the present invention, the encryption / decryption means transmits the encrypted data sent from the terminal having the encryption processing function to the other terminal not having the encryption processing function. Decrypt already transmitted data and send it to another terminal that does not have the cryptographic processing function, and send unencrypted data sent from the terminal that does not have the cryptographic processing function to another terminal that has the cryptographic processing function In this case, the unencrypted data is encrypted and transmitted to another terminal having the encryption processing function.

In another aspect of the present invention, a plurality of ports to which a terminal having a cryptographic processing function is directly or indirectly connected to at least one port, and a physical layer and a data link input from one of the plurality of ports Encryption / decryption means for performing encryption processing or decryption processing on data passed through the layer, and routing between the networks subjected to encryption processing or decryption processing by the encryption / decryption means Bridge means for outputting from other ports via the data link layer and the physical layer without passing to the network layer that performs control, and the bridge means exists below the network layer .

  In still another aspect of the present invention, the information processing apparatus includes setting information storage means for storing setting information related to the control of the encryption process and the decryption process, and the encryption / decryption means is stored in the setting information storage means. The encryption processing and the decryption processing are controlled by comparing setting information with header information added to a packet input from the one port.

Also, the encryption method of the present invention is a method of performing encryption processing or decryption processing in an encryption device having a plurality of ports and having a terminal having an encryption processing function connected to at least one port directly or indirectly. Then, encryption processing or decryption processing is performed on data input from one of the plurality of ports and passed through the physical layer and the data link layer, and the obtained data is transferred to the network. It is characterized in that the data is output from another port via the data link layer and the physical layer without passing to the network layer that performs routing control between networks via the bridge means existing below the layer.

According to another aspect of the present invention, there is provided an encryption system comprising: the encryption apparatus according to claim 1; and a terminal having an encryption processing function connectable to the encryption apparatus via a wireless or wired network. To do.

In another aspect of the present invention, a terminal having an encryption processing function, a terminal not having an encryption processing function, and a terminal having an encryption processing function and a terminal not having an encryption processing function are connected via a wireless or wired network. And the encryption device according to claim 2, which is connectable .

In another aspect of the present invention, the bridge means is an IP-Sec bridge, and data communication processing is performed in a layer lower than the network layer.

  As described above, the present invention includes an encryption device including encryption / decryption means for performing encryption processing and encryption decryption processing in order to terminate security by encryption with a terminal having an encryption processing function introduced. Since this encryption device is connected to a terminal via a network, it becomes possible to use encryption even in a corporate LAN having a terminal on which dedicated encryption software cannot be installed. It is possible to reduce the risk of confidential information inside the LAN being stolen or altered by intrusion or attack.

  Further, in the present invention, since the data subjected to the encryption process or the decryption process is output without being passed to the network layer for performing the routing control between the networks, the IP address of the encryption device is not required at the time of data communication. It can be. In addition, since the IP address does not change between the input port and the output port of the encryption device, the IP address can be kept transparent regardless of whether or not the encryption device is connected on the network. This also eliminates the need to change the address setting of the terminal. This makes it possible to use encryption in the corporate LAN without performing complicated operations such as address setting.

FIG. 1 is a diagram showing a hierarchical structure of protocols in a conventional VPN router and a personal computer connected thereto.
FIG. 2 is a diagram for explaining an IP address of a packet flowing on the network in the conventional system.
FIG. 3 is a diagram illustrating a configuration example of a cryptographic system to which the cryptographic apparatus according to the present embodiment is applied.
FIG. 4 is a diagram illustrating another configuration example of the cryptographic system to which the cryptographic apparatus according to the present embodiment is applied.
FIG. 5 is a diagram illustrating still another configuration example of the cryptographic system to which the cryptographic apparatus according to the present embodiment is applied.
FIG. 6 is a diagram illustrating still another configuration example of the cryptographic system to which the cryptographic apparatus according to the present embodiment is applied.
FIG. 7 is a diagram showing a hierarchical structure of protocols in the encryption apparatus according to the present embodiment, a DB server connected to the encryption apparatus, and a personal computer.
FIG. 8 is a diagram for explaining an IP address of a packet flowing on the network in the present embodiment.
FIG. 9 is a diagram for explaining a MAC address of a packet that flows through the encryption apparatus according to the present embodiment.
FIG. 10 is a diagram for explaining a MAC address of a packet flowing through a conventional VPN router.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 3 is a diagram illustrating an overall configuration example of a cryptographic system to which the cryptographic apparatus according to the present embodiment is applied.

  In FIG. 3, reference numeral 1 denotes an encryption apparatus according to the present embodiment, which has two ports. One port is connected to devices such as the network printer 2, the DB server 3, and the network terminal 4, and the other port is connected to the other port. A hub 5 is connected. The encryption device 1 relays data between a hub 5 and devices such as a network printer 2, a DB server 3, and a network terminal 4.

  The network printer 2 is a terminal that cannot physically install encryption software. The DB server 3 is a terminal in which it is not preferable to install extra encryption software due to problems such as operational stability. The network terminal 4 is a terminal that has no OS and cannot operate encryption software. Therefore, it is assumed that encryption software is not installed in these terminals 2 to 4.

  The hub 5 is a device that relays data in the physical layer. In addition to the encryption device 1 described above, an access point 6 for wireless communication and a desktop personal computer 7 are connected. That is, the hub 5 in this case relays data between the encryption device 1, the access point 6 and the desktop personal computer 7.

  Further, a desktop personal computer 8 and a laptop personal computer 9 are connected to the access point 6 by radio. It is assumed that encryption software for encrypting and decrypting data can be installed in the desktop personal computers 7 and 8 and the laptop personal computer 9 and actually installed.

  As described above, the encryption apparatus 1 according to the present embodiment has two ports, and the personal computers 7 to 9 which are terminals having an encryption processing function for one port are indirectly connected via the hub 5 or the access point 6. It is connected to the. A network printer 2, a DB server 3, and a network terminal 4 are directly connected to the other port. The encryption device 1, the network printer 2, the DB server 3, the network terminal 4, the hub 5, the access point 6, and the personal computers 7 to 9 constitute one base network.

  With such a configuration, the network printer 2, the DB server 3 and the network terminal 4 in which the encryption software is not installed, and the personal computers 7 to 9 in which the encryption software is installed (these devices 2 to 4 and 7 to 9 are any Is also equivalent to the terminal of the present invention), and data communication is performed via the encryption device 1, the hub 5 and the access point 6.

  At that time, the encryption device 1 communicates encrypted data with the personal computers 7 to 9 on which the encryption software is installed, and encrypts with the terminals 2 to 4 on which the encryption software is not installed. Encryption processing and encryption decryption processing are performed in order to communicate unencrypted data.

  For example, when data is sent from the desktop personal computer 7 to the network printer 2 and printed out, the data is first encrypted using encryption software installed in the desktop personal computer 7 and supplied to the encryption device 1 via the hub 5. To do. Next, the encryption device 1 decrypts the received data and sends it to the network printer 2.

  For example, when data managed by the DB server 3 is taken into the laptop personal computer 9, the DB server 3 supplies the corresponding data to the encryption device 1 in response to a given request. The encryption device 1 that has received the unencrypted data encrypts the data and transmits it to the laptop personal computer 9 via the hub 5 and the access point 6. The laptop personal computer 9 decrypts the received data and uses it for desired processing.

  As is clear from the above description, by using the encryption device 1 of the present embodiment, encryption can be used even in an in-house LAN having terminals 2 to 4 where dedicated encryption software cannot be installed. As a result, it is possible to construct a secure network 10 with a low risk of confidential information inside the LAN being stolen or tampered with by unauthorized intrusion or attack from the outside.

  In addition, although encryption cannot be used between the encryption apparatus 1 and each terminal 2-4, the cable 11 which connects these is a physically short wiring, and an eavesdropping and alteration are performed by this part being externally attacked. The possibility is extremely low, so there is no particular security problem.

  FIG. 4 is a diagram illustrating another configuration example of the cryptographic system to which the cryptographic apparatus according to the present embodiment is applied. In FIG. 4, components having the same functions as those shown in FIG. 3 are given the same reference numerals. As shown in FIG. 4, in the encryption device 1 of the present embodiment, the Internet 20 is connected to one port, and the hub 5 is connected to the other port.

  In the case of FIG. 4, one base network is configured by the encryption device 1, the hub 5, the access point 6, and the personal computers 7 to 9. Further, encryption software is installed at the end of the Internet 20 such as the network printer 2, the DB server 3 and the network terminal 4 shown in FIG. Multiple terminals are connected to form another base network.

  In the example illustrated in FIG. 3, one device is connected to one encryption device 1, and one encryption device 1 performs encryption / decryption processing related to one device exclusively. That is, the encryption device 1 shown in FIG. 3 is connected between the personal computers 7 to 9 on which the encryption software is installed and one device on which the encryption software is not installed, and encrypts the one device. Security was terminated.

  On the other hand, in the example shown in FIG. 4, the encryption device 1 is connected between the personal computers 7 to 9 installed with encryption software and a plurality of devices connected to the Internet 20. The plurality of devices need not be installed with encryption software such as the network printer 2, the DB server 3 and the network terminal 4 shown in FIG. 3, or installed with encryption software such as the personal computers 7-9. May be. As described above, the encryption apparatus 1 according to the present embodiment can also terminate security by encryption for a plurality of devices. In this case, the encryption device 1 has data paths as many as the number of connected devices, and performs encryption / decryption processing with different encryption keys for each device.

  For example, when data is sent from the desktop personal computer 7 in the secure network 10 to an external device that does not have encryption software via the Internet 20, data is first transmitted using the encryption software installed in the desktop personal computer 7. The data is encrypted and supplied to the encryption device 1 via the hub 5. Next, the encryption device 1 decrypts the received data and sends it to the external device via the Internet 20.

  For example, when data managed by an external device that does not have encryption software at the end of the Internet 20 is taken into the laptop personal computer 9 in the secure network 10, the external device corresponds to the request given. Data to be transmitted to the Internet 20. The encryption device 1 that has received the unencrypted data encrypts the data and transmits it to the laptop personal computer 9 via the hub 5 and the access point 6. The laptop personal computer 9 decrypts the received data and uses it for desired processing.

  On the other hand, when data is sent from the desktop personal computer 7 in the secure network 10 to an external device having encryption software via the Internet 20, the data is first encrypted using the encryption software installed on the desktop personal computer 7. And supplied to the encryption device 1 via the hub 5. Next, the encryption apparatus 1 sends the received data to an external device via the Internet 20 without decrypting the received data. The external device decrypts the received data and uses it for desired processing.

  Conversely, when data encrypted by an external device ahead of the Internet 20 is sent to the desktop personal computer 7 in the secure network 10, the encryption device 1 decrypts the data received from the external device via the Internet 20. Without being converted, the encrypted data is supplied to the desktop personal computer 7 via the hub 5.

  In this way, even when data communication is performed between the terminals 7 to 9 in the secure network 10 and an external device that does not have encryption software connected to the Internet 20, at least the inside of the secure network 10 is protected by encryption. Can be used. If encryption software is installed in an external device connected to the Internet 20, the encryption can also be used on the Internet 20 outside the secure network 10.

  The plurality of devices do not necessarily have to be connected via the Internet 20, and may be connected to the encryption device 1 directly or via a hub. In the case of direct connection, the encryption device 1 has two or more ports.

  FIG. 5 is a diagram illustrating still another configuration example of the cryptographic system to which the cryptographic apparatus according to the present embodiment is applied. In FIG. 5, components having the same functions as those shown in FIG. 3 are given the same reference numerals. The example shown in FIG. 5 is also an example in which one encryption apparatus 1 terminates security by encryption for a plurality of devices, similarly to the example of FIG.

  In the example shown in FIG. 5, the three personal computers 7 to 9 are all connected to the access point 6 via the wireless LAN inside the secure network 10. The access point 6 is connected to the Internet 20 via the encryption device 1.

  FIG. 6 is a diagram illustrating still another configuration example of the cryptographic system to which the cryptographic apparatus according to the present embodiment is applied. In FIG. 3 to FIG. 5, as examples of terminals having the cryptographic processing function of the present invention, personal computers 7 to 9 installed with cryptographic software are cited, and security by encryption between the cryptographic device 1 and the personal computers 7 to 9 is given. An example of terminating the above has been described. The terminal having the cryptographic processing function is not limited to this example, and includes other cryptographic apparatuses having the same function as the cryptographic apparatus 1. FIG. 6 shows a configuration example in this case.

In the example shown in FIG. 6, two base networks 30 </ b> A and 30 </ b> B of bases A and B are connected via routers 40 </ b> A and 40 </ b> B and the Internet 20. In the site A network 30A, personal computers 31A to 33A and encryption devices 1A- _{1 to} 1A _{- 3} constitute an in-house LAN. Each of the personal computers 31A to 33A is a terminal in which encryption software is not installed. Each of the encryption devices 1A- _{1 to} 1A _{- 3} has the same function as that of the encryption device 1 of FIG. 3, and the personal computers 31A to 33A are connected to one port, and the router 40A is connected to the other port. Is connected.

Similarly, in the base B network 30B, the personal computers 31B to 33B and the encryption devices 1B- _{1 to} 1B _{- 3} constitute an in-company LAN. All of the personal computers 31B to 33B are terminals on which no encryption software is installed. Each of the encryption devices 1B- _{1 to} 1B _{- 3} has the same function as that of the encryption device 1 of FIG. 3. The personal computers 31B to 33B are connected to one port, and the router 40B is connected to the other port. Is connected.

With this configuration, data communication is performed between the personal computers belonging to the different base networks 30A and 30B via the encryption devices 1A- _{1 to} 1A _{- 3} and 1B- _{1 to} 1B _{- 3} . For example, when transmitting data from the personal computer 31A in the base A network 30A to the personal computer 33B in the base B network 30B, the encryption device 1A- ₁ encrypts the data given from the personal computer 31A, and the router 40A, the Internet 20 and the router 40B to transmit to the encryption device 1B- ₃ . The encryption device 1B- ₃ decrypts the received data and supplies it to the personal computer 33B. Thereby, encryption can be used between the different base networks 30A and 30B.

Further, for example, in the base A network 30A, data communication is performed via the encryption devices 1A- _{1 to} 1A _{- 3} between the personal computers 31A to 33A in which the encryption software is not installed. For example, when data is transmitted from a personal computer 31A to another personal computer 33A, the encryption device 1A- ₁ encrypts the data provided from the personal computer 31A and transmits the data to the encryption device 1A- ₃ . The encryption device 1A- ₃ decrypts the received data and supplies it to the personal computer 33A.

Similarly, in the base B network 30B, data communication is performed via the encryption devices 1B- _{1 to} 1B _{- 3} between the personal computers 31B to 33B in which the encryption software is not installed. For example, when data is transmitted from a certain personal computer 31B to another personal computer 33B, the encryption device 1B- ₁ encrypts the data provided from the personal computer 31B and transmits it to the encryption device 1B- ₃ . The encryption device 1B- ₃ decrypts the received data and supplies it to the personal computer 33B.

As described above, the encryption devices 1A- _{1 to} 1A _{- 3} and 1B- _{1 to} 1B _{- 3} are not encrypted with the personal computers 31A to 33A and 31B to 33B in which the encryption software is not installed. performs the communication, the encryption process and for communicating data encrypted with the cryptographic device _{1A -1 ~1A -3, 1B -1 ~1B} -3 is a terminal having a cipher processing function Performs decryption processing of encryption.

By connecting the encryption devices 1A _{-1 to} 1A _-3 and 1B _{-1 to} 1B _-3 as described above in the immediate vicinity of the personal computers 31A to 33A and 31B to 33B, it is natural that the different base networks 30A and 30B are connected. In addition, it is possible to use encryption even in an in-house LAN without a personal computer having encryption software. As a result, each of the base networks 30A and 30B can be a secure network with little risk of confidential information inside the LAN being stolen or falsified due to unauthorized intrusion or attack from the outside.

In the example of FIG. 6 described above, each of the base networks 30A and 30B includes a plurality of terminals (encryption apparatuses 1A _{-1 to} 1A _-3 and 1B _{-1 to} 1B _-3 ) having a cryptographic processing function. However, at least one base network may have only one terminal having a cryptographic processing function. For example, the base network 30A may be configured by connecting one personal computer 31A and one cryptographic device 1A- ₁ .

In this case, similar to the configuration shown in FIG. 6, encryption can be used between the different base networks 30A and 30B. In addition, regarding the base network 30A, the encryption device 1A- ₁ can be used between the gateway of the base network 30A and the encryption device 1A- ₁ by connecting the encryption device 1A- ₁ in the immediate vicinity of the personal computer 31A. it can.

In the example of FIG. 6, the two base networks 30A and 30B are connected by the Internet 20, and the encryption devices 1A _{-1 to} 1A _-3 , 1B _{-1 to} 1B _-3 and the personal computer 31A are connected to the base networks 30A and 30B. Although shown about the example provided with -33A and 31B-33B, respectively, it is not limited to this.

For example, the personal computers 31A to 33A and 31B that are provided with the encryption devices 1A- _{1 to} 1A _{- 3} , 1B- _{1 to} 1B _{- 3} and the personal computers 31A to 33A, 31B to 33B in one base network, and in which the encryption software is not installed. To 33B may be exchanged via the encryption devices 1A- _{1 to} 1A _{- 3} and 1B- _{1 to} 1B _{- 3} . In this case, within one branch network, at least the encryption device 1A _-1 to 1A _-3, is between 1B _-1 ~1B _-3 can utilize encryption.

  In addition to this, for example, in the configuration shown in FIG. 3, the encryption device 1 is used as the hub 5 by using a personal computer on which encryption software is not installed and the encryption device 1 instead of the personal computer 7 on which encryption software is installed. It is good also as a structure to connect. In this case, between devices such as the network printer 2, the DB server 3, and the network terminal 4 that cannot install encryption software, and a personal computer on which encryption software is not installed, the encryption device 1 that is connected immediately to both of them is used. Can be used for encrypted communication.

  FIG. 7 is a diagram showing a hierarchical structure of protocols in the encryption device 1 and the DB server 3 and the laptop personal computer 9 directly and indirectly connected to the encryption device 1 in the encryption system shown in FIG. In the example shown in FIG. 7, encryption software is not installed in the DB server 3 (no IP-Sec), and encryption software is installed in the laptop personal computer 9 (has IP-Sec). Between the DB server 3 and the laptop personal computer 9, the encryption device 1 of this embodiment is connected. Here, it is assumed that the data stored in the DB server 3 is sent to the encryption device 1, where the data is encrypted and sent to the personal computer 9.

  As shown in FIG. 7, the DB server 3 and the personal computer 9 each have one port 31, 32, and the encryption device 1 serving as the relay device has two ports 33, 34. The physical layer and the MAC layer (data link layer) are individually provided for the ports 33 and 34 of the encryption device 1, and the IP-Sec (encryption / decryption processing function) and IP are common to the ports 33 and 34, respectively. A layer (network layer) and a TCP / UDP layer (transport layer) are provided. As described above, the encryption device 1 of the present embodiment is characterized in that the two ports 33 and 34 are bridged by IP-Sec.

  Here, “bridging” refers to outputting data input from one port and subjected to encryption processing or decryption processing to another port without performing routing processing. In the example of FIG. 7, the data input from the first port 33 is encrypted by IP-Sec, and the obtained data is passed to the IP layer without being routed in the IP layer. (Without) passing to the other port as it is and outputting it is equivalent to “bridging”. As described above, in the encryption device 1 according to the present embodiment, the data transfer between the DB server 3 and the personal computer 9 does not use the IP layer and the TCP / UDP layer, but performs processing in a lower layer than the IP layer.

  That is, the packet data created by the DB server 3 is transmitted through the MAC layer and the physical layer of the DB server 3 and is received from the first port 33 of the encryption device 1. The received packet data is passed to the IP-Sec through the physical layer and the MAC layer, where encryption processing is performed. The encrypted packet data is transmitted from the second port 34 through the MAC layer and the physical layer.

  The packet data transmitted from the second port 34 is received by the personal computer 9, passed to the IP-Sec through the physical layer and the MAC layer, and the encryption is decrypted. Then, the decrypted data is passed through the IP layer to an application layer (not shown). Thereby, even if the DB server 3 does not include encryption software, it becomes possible to transmit the encrypted data to the personal computer 9.

  In the present embodiment, the IP layer and the TCP / UDP layer are used when various types of information regarding encryption / decryption are set in the encryption device 1 itself. For example, there is encryption / decryption processing such as performing encrypted communication between a certain terminal and a certain terminal but not performing encrypted communication with other terminals, and discarding packets between a certain terminal and a certain terminal. In the case where various information relating to whether or not communication is possible, encryption level in case of performing encryption communication, time zone for encryption, encryption key, etc. is set in the encryption device 1, the IP layer and the TCP / UDP layer Is used.

  This type of setting information is held on the memory by the function of the IP-Sec bridge. The IP-Sec collates the setting information held in the memory with the header information (for example, the source IP address and the destination IP address) added to the packet input from the ports 33 and 34. Controls encryption / decryption processing.

  As described above, in the encryption device 1 of the present embodiment, data input from one port is encrypted / decrypted by IP-Sec, and routing processing is performed without passing the obtained data to the IP layer. Therefore, the IP address of the encryption device 1 can be made unnecessary at the time of data communication. That is, it is possible to perform IP layer encryption / decryption processing without having an IP address. Therefore, it is possible to eliminate the need for complicated IP address setting for the encryption device 1 itself.

  Further, the terminals connected to both sides of the encryption device 1 belong to the same network, and the IP address does not change between the input port and the output port of the encryption device 1. Thereby, the transparency of the IP address can be maintained regardless of whether or not the encryption device 1 is connected on the network. That is, when the encryption device 1 is connected to the network or the encryption device 1 is removed from the network, it is not necessary to change the address setting of the terminal connected to the encryption device 1.

  For example, when the encryption device 1 is inserted between the DB server 3 and the personal computer 9 as shown in FIG. 7 or when the direct communication is performed between the DB server 3 and the personal computer 9 without inserting the encryption device 1. The IP address of the packet flowing between the DB server 3 and the personal computer 9 remains unchanged as shown in FIG. Therefore, there is no need to change the address setting depending on whether or not the encryption device 1 is connected.

  Thereby, at the time of introduction or maintenance of the network system, it is only necessary to insert or remove the encryption device 1 of this embodiment in an appropriate place, and it is not necessary to perform complicated address setting. The load can be greatly reduced.

  Further, in the case of this embodiment, it is possible to maintain transparency even for the MAC address. FIG. 9 is a diagram showing a packet when data is sent from the DB server 3 to the personal computer 9 and the data is encrypted by the encryption device 1 during that time. For comparison with the present embodiment, FIG. 10 shows a case where data is transmitted from one personal computer 101 to the other personal computer 102 in the conventional system shown in FIG. FIG.

  FIGS. 9A and 10A show packets received at the first ports 33 and 107, and FIGS. 9B and 10B show packets transmitted from the second ports 34 and 108. FIG. Indicates. IP-Sec has a transport mode in which only the data part is encrypted, and a tunnel mode in which all packets are encrypted and a new header is added. Regarding the transmission packet, these two modes are shown respectively.

  As apparent from FIG. 9, according to the present embodiment, not only the IP address but also the MAC address is not different between the first port 33 and the second port 34, and the MAC address transparency is maintained. be able to. That is, the encryption apparatus 1 of the present embodiment simply passes data input from one port to the other port except for having the IP-Sec and performing data encryption / decryption processing. A MAC address can be made unnecessary during communication.

  In the above embodiment, the IP layer is given as an example of the network layer corresponding to the third layer of the OSI reference model. This IP layer is an IPX (Internetwork Packet eXchange) layer that is a protocol used by the Novell network OS. There may be. Other protocols may be used as long as IP-Sec can be used.

  In addition, the embodiment described above is merely an example of actualization in carrying out the present invention, and the technical scope of the present invention should not be construed in a limited manner. In other words, the present invention can be implemented in various forms without departing from the spirit or main features thereof.

  The present invention reduces the risk of confidential information inside the LAN being stolen or falsified by unauthorized intrusion or attack from the outside by using encryption even in an in-house LAN having terminals that cannot install dedicated encryption software. Useful to be able to. Further, the present invention is useful for enabling encryption to be used in a corporate LAN without performing complicated work such as address setting.

Claims (11)

A plurality of ports to which a terminal having a cryptographic processing function is directly or indirectly connected to at least one port;
Encryption / decryption means for performing encryption processing and decryption processing of data in order to terminate security by encryption with a terminal having the encryption processing function;
Bridge means for outputting data inputted from one of the plurality of ports and subjected to encryption processing or decryption processing by the encryption / decryption means to other ports without performing routing processing in the network layer It equipped with a door,
The encryption device characterized in that the bridge means exists below the network layer . The encryption / decryption means performs communication of encrypted data with a terminal having the encryption processing function and communication of unencrypted data with a terminal having no encryption processing function. The encryption apparatus according to claim 1 , wherein the encryption process and the decryption process are performed for the purpose. The encryption / decryption means decrypts the encrypted data and transmits the encrypted data sent from the terminal having the encryption processing function to another terminal not having the encryption processing function. When sending unencrypted data sent from another terminal that does not have an encryption processing function to another terminal that does not have an encryption processing function, 3. The encryption apparatus according to claim 2, wherein data is encrypted and transmitted to another terminal having the encryption processing function. 2. The encryption apparatus according to claim 1, wherein the bridge means is an IP-Sec bridge, and data communication processing is performed in a layer lower than the network layer. A plurality of ports to which a terminal having a cryptographic processing function is directly or indirectly connected to at least one port;
Encryption / decryption means for performing encryption processing or decryption processing on data input from one port among the plurality of ports and passed through the physical layer and the data link layer;
Data that has been encrypted or decrypted by the encryption / decryption means is output from another port via the data link layer and physical layer without passing to the network layer that performs routing control between networks. and a bridge means that,
The encryption device characterized in that the bridge means exists below the network layer . Setting information storage means for storing setting information related to the control of the encryption process and the decryption process;
The encryption / decryption unit compares the setting information stored in the setting information storage unit with the header information added to the packet input from the one port, and performs the encryption process and the decryption. The encryption apparatus according to claim 5 , wherein the process is controlled. 6. The encryption apparatus according to claim 5, wherein the bridge means is an IP-Sec bridge, and data communication processing is performed below the network layer. A method of performing an encryption process or a decryption process in an encryption device having a plurality of ports and a terminal having an encryption processing function connected to at least one port directly or indirectly,
Performs encryption processing or decryption processing on data passed via the physical layer and data link layer is input from one port of the plurality of ports, the data obtained by this, lower than the network layer The encryption method is characterized in that the data is output from another port via the data link layer and the physical layer without passing to the network layer that performs routing control between networks via the bridge means existing in the network. 9. The encryption method according to claim 8, wherein the bridge means is an IP-Sec bridge, and data communication processing is performed in a layer lower than the network layer. A cryptographic device according to claim 1;
A cryptographic system comprising: a terminal having a cryptographic processing function that is connectable to the cryptographic apparatus via a wireless or wired network . A terminal having a cryptographic processing function;
A terminal that does not have a cryptographic processing function;
An encryption device comprising: the encryption device according to claim 2, which is connectable between a terminal having the encryption processing function and a terminal not having the encryption processing function via a wireless or wired network. system.

Images